colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #67130 from uvNikita/containers/unprivileged

Browse Source 
nixos/containers: add unprivileged option
This commit is contained in:
Marek Mahut 2019-08-23 08:00:35 +02:00 committed by GitHub
commit 27acea73b8
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 71 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
nixos/modules/virtualisation/containers.nix
View File

@ -139,6 +139,7 @@ let
--bind="/nix/var/nix/profiles/per-container/$INSTANCE:/nix/var/nix/profiles" \
--bind="/nix/var/nix/gcroots/per-container/$INSTANCE:/nix/var/nix/gcroots" \
${optionalString (!cfg.ephemeral) "--link-journal=try-guest"} \
${optionalString (cfg.unprivileged) "-U"} \
--setenv PRIVATE_NETWORK="$PRIVATE_NETWORK" \
--setenv HOST_BRIDGE="$HOST_BRIDGE" \
--setenv HOST_ADDRESS="$HOST_ADDRESS" \
@ -238,8 +239,8 @@ let
ExecReload = pkgs.writeScript "reload-container"
''
#! ${pkgs.runtimeShell} -e
${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
${pkgs.systemd}/bin/machinectl shell "$INSTANCE" \
''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test
'';
SyslogIdentifier = "container %i";
@ -423,6 +424,7 @@ let
extraVeths = {};
additionalCapabilities = [];
ephemeral = false;
unprivileged = false;
allowedDevices = [];
hostAddress = null;
hostAddress6 = null;
@ -516,6 +518,16 @@ in
'';
};
unprivileged = mkOption {
type = types.bool;
default = false;
description = ''
Run container in unprivileged mode using private users feature of <command>systemd-nspawn</command>.
This option is eqvivalent of adding -U parameter to <command>systemd-nspawn</command> command.
See <literal>systemd-nspawn(1)</literal> man page for more information.
'';
};
ephemeral = mkOption {
type = types.bool;
default = false;

1
nixos/tests/all-tests.nix
View File

@ -48,6 +48,7 @@ in
colord = handleTest ./colord.nix {};
containers-bridge = handleTest ./containers-bridge.nix {};
containers-ephemeral = handleTest ./containers-ephemeral.nix {};
containers-unprivileged = handleTest ./containers-unprivileged.nix {};
containers-extra_veth = handleTest ./containers-extra_veth.nix {};
containers-hosts = handleTest ./containers-hosts.nix {};
containers-imperative = handleTest ./containers-imperative.nix {};

56
nixos/tests/containers-unprivileged.nix Normal file
View File

@ -0,0 +1,56 @@
# Test for NixOS' container support.
import ./make-test.nix ({ pkgs, ...} : {
name = "containers-unprivileged";
machine = { pkgs, ... }: {
virtualisation.memorySize = 768;
virtualisation.writableStore = true;
containers.webserver = {
unprivileged = true;
privateNetwork = true;
hostAddress = "10.231.136.1";
localAddress = "10.231.136.2";
config = {
services.nginx = {
enable = true;
virtualHosts.localhost = {
root = (pkgs.runCommand "localhost" {} ''
mkdir "$out"
echo hello world > "$out/index.html"
'');
};
};
networking.firewall.allowedTCPPorts = [ 80 ];
};
};
};
testScript = ''
$machine->succeed("nixos-container list") =~ /webserver/ or die;
# Start the webserver container.
$machine->succeed("nixos-container start webserver");
my $ip = $machine->succeed("nixos-container show-ip webserver");
chomp $ip;
$machine->succeed("ping -n -c1 $ip");
# Check that container root folder is owned by a new private user
$machine->succeed('test $(stat -c "%U" /var/lib/containers/webserver) == "vu-webserver-0"');
# Check that webserver is working before reload
$machine->succeed("curl --fail http://$ip/ > /dev/null");
# Reload container
$machine->succeed('systemctl reload container@webserver');
# Check that webserver is working after reload
$machine->succeed("curl --fail http://$ip/ > /dev/null");
# Stop the container.
$machine->succeed("nixos-container stop webserver");
$machine->fail("curl --fail --connect-timeout 2 http://$ip/ > /dev/null");
'';
})